skills.rest
NeverSight
NeverSightOFFICIAL
Explore all skills by this author →
Website𝕏@neversightaiGitHub

reverse-engineering-tools

Guide debugging, disassembly, decompilation, and instrumentation workflows for protected game binaries.

69|11|Updated May 16, 2026
Search Tags:#kernel debugging#reverse engineering#deobfuscation#disassembly#anti-cheat#anti-debugging#dynamic instrumentation
One-click install
npx skills add https://github.com/NeverSight/NeverC --skill reverse-engineering-tools-neversight
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineering-tools
Source: https://github.com/NeverSight/NeverC/tree/main/.agents/skills/reverse-engineering-tools
Command: npx skills add https://github.com/NeverSight/NeverC --skill reverse-engineering-tools-neversight

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Reverse engineering protected game binaries and anti-cheat components without losing visibility to anti-debugging, anti-disassembly, virtualization/packing, or environment checks.

Core Features & Use Cases

  • Debugging & inspection toolchain: Guidance on user-mode and kernel-mode debugging workflows (e.g., Cheat Engine, WinDbg, HyperDbg) for tracing execution and memory state in adversarial targets.
  • Disassembly, decompilation & memory analysis: Coverage of common RE platforms (IDA/Ghidra/Binary Ninja/Radare2) plus memory scanning and dump analysis approaches for reconstructing logic and data layouts.
  • Dynamic instrumentation & hypervisor-assisted tracing: Techniques for API hooking, tracing, and trap-driven execution to capture control-flow behavior under anti-analysis constraints.
  • Anti-analysis bypass and obfuscation recovery patterns: Catalog-style coverage of anti-debug/VM evasion and deobfuscation tactics (MBA, control-flow flattening, opaque predicates, virtualization-based obfuscation, binary lifting), plus ROP discovery/assistance tooling.
  • Workflow best practices: Structured guidance for identifying protections, tracing execution flow, and documenting IOCTLs/callbacks/trust boundaries.

Quick Start

Use the reverse-engineering-tools skill to plan a protected-game analysis session by selecting the appropriate debugger, instrumentation strategy, and deobfuscation technique based on the target’s protection category.

Frequently Asked Questions about reverse-engineering-tools

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I bypass anti-debugging protections when reverse engineering game binaries?▼

Kernel debugging protected anti-cheat components requires using debuggers like WinDbg or HyperDbg for driver IOCTL tracing and callback inspection, applying an anti-analysis-aware methodology to avoid losing visibility to environment checks.

What is the best way to deobfuscate VMP and control-flow flattened binaries?▼

Recovering virtualization-based obfuscation like VMP uses deobfuscation tactics including MBA analysis, binary lifting, and opaque predicate removal within disassembly platforms like IDA, Ghidra, or Binary Ninja to reconstruct control flow.

Can I use dynamic instrumentation for API hooking in kernel-mode anti-cheat analysis?▼

Yes, dynamic instrumentation enables API hooking and trap-driven execution tracing to capture control-flow behavior in both user-mode and kernel-mode environments, maintaining tracing visibility even under strict anti-analysis constraints.

How do I trace driver IOCTLs and callbacks during protected game analysis?▼

Tracing driver IOCTLs and callbacks requires kernel-mode debugging workflows using tools like WinDbg or HyperDbg to inspect trust boundaries, monitor execution flow, and document interactions within adversarial anti-cheat targets.

Why does disassembly fail on packed or virtualized game executables?▼

Disassembly fails because virtualization-based obfuscation and packing obscure control flow, requiring memory scanning, dump analysis, and binary lifting approaches to reconstruct the underlying logic and data layouts.

Do I need a hypervisor-aware debugger to analyze obfuscated anti-cheat drivers?▼

Hypervisor-aware debuggers are necessary when standard user-mode or kernel-mode debugging loses visibility to anti-debug techniques and environment checks, requiring hypervisor-assisted tracing to capture execution flow safely.

Related Skills

Explore More Education & Research Skills→
igamenovoerigamenovoer
7

pixi-make-cu-build-env

Configure CUDA build environments for Pixi projects with CMake and nvcc.

Community
Advanced
EntroVyxEntroVyx
3

bug-bounty

Orchestrate reconnaissance, vulnerability research, and exploit chain development for authorized bug bounty programs.

Community
Advanced
cyberkaidacyberkaida
797

ctf-pwn

Identify memory corruption vulnerabilities in CTF binaries and outline exploitation plans.

Community
Advanced
alicangnllalicangnll

VM/Obfuscation Detection

Detect VMProtect, Themida, UPX, and control flow flattening in binaries.

Community
Advanced